On-the-fly stream compression that doesn't spill over into hardware resources?

Question

I have 200 GB free disk space, 16 GB of RAM (of which ~1 GB is occupied by the desktop and kernel) and 6 GB of swap.

I have a 240 GB external SSD, with 70 GB used¹ and the rest free, which I need to back up to my disk.

Normally, I would dd if=/dev/sdb of=Desktop/disk.img the disk first, and then compress it, but making the image first is not an option since doing so would require far more disk space than I have, even though the compression step will result in the free space being squashed so the final archive can easily fit on my disk.

dd writes to STDOUT by default, and gzip can read from STDIN, so in theory I can write dd if=/dev/sdb | gzip -9 -, but gzip takes significantly longer to read bytes than dd can produce them.

From man pipe:

Data written to the write end of the pipe is buffered by the kernel until it is read from the read end of the pipe.

I visualise a | as being like a real pipe -- one application shoving data in and the other taking data out of the pipe's queue as quickly as possible.

What when the program on the left side writes more data more quickly than the other side of the pipe can hope to process it? Will it cause extreme memory or swap usage, or will the kernel try to create a FIFO on disk, thereby filling up the disk? Or will it just fail with SIGPIPE Broken pipe if the buffer is too large?

Basically, this boils down to two questions:

1. What are the implications and outcomes of shoving more data into a pipe than is read at a time?
2. What's the reliable way to compress a datastream to disk without putting the entire uncompressed datastream on the disk?

_{Note 1: I cannot just copy exactly the first 70 used GB and expect to get a working system or filesystem, because of fragmentation and other things which will require the full contents to be intact.}

Answer 1

dd reads and writes data one block at a time, and it only ever has one block outstanding. So

valgrind dd if=/dev/zero status=progress of=/dev/null bs=1M

shows that dd uses approximately 1MB of memory. You can play around with the block size, and drop valgrind, to see the effect on dd’s speed.

When you pipe into gzip, dd simply slows down to match gzip’s speed. Its memory usage doesn’t increase, nor does it cause the kernel to store the buffers on disk (the kernel doesn’t know how to do that, except via swap). A broken pipe only happens when one of the ends of the pipe dies; see signal(7) and write(2) for details.

Thus

dd if=... iconv=fullblock bs=1M | gzip -9 > ...

is a safe way to do what you’re after.

When piping, the writing process ends up being blocked by the kernel if the reading process isn’t keeping up. You can see this by running

strace dd if=/dev/zero bs=1M | (sleep 60; cat > /dev/null)

You’ll see that dd reads 1MB, then issues a write() which sits there waiting for one minute while sleep runs. That’s how both sides of a pipe balance out: the kernel blocks writes if the writing process is too fast, and it blocks reads if the reading process is too fast.

Answer 2

Technically you don't even need dd:

gzip < /dev/drive > drive.img.gz

If you do use dd, you should always go with larger than default blocksize like dd bs=1M or suffer the syscall hell (dd's default blocksize is 512 bytes, since it read()s and write()s that's 4096 syscalls per MiB, too much overhead).

gzip -9 uses a LOT more CPU with very little to show for it. If gzip is slowing you down, lower the compression level, or use a different (faster) compression method.

If you're doing file based backups instead of dd images, you could have some logic that decides whether to compress at all or not (there's no point in doing so for various file types). dar (tar alternative`) is one example that has options to do so.

If your free space is ZERO (because it's an SSD that reliably returns zero after TRIM and you ran fstrim and dropped caches) you can also use dd with conv=sparse flag to create an uncompressed, loop-mountable, sparse image that uses zero disk space for the zero areas. Requires the image file to be backed by a filesystem that supports sparse files.

Alternatively for some filesystems there exist programs able to only image the used areas.

Answer 3

There are no negative implications other than performance: the pipe has a buffer, which is usually 64K, and after that, a write to the pipe will simply block until gzip reads some more data.

Answer 4

Answering the actual question as to how it works: "what if the program on the left side writes more data more quickly than the other side of the pipe can hope to process it?"

This doesn't happen. There is a fairly small, limited size buffer in the pipe; see How big is the pipe buffer?

Once the pipe buffer is full, the sending program blocks. When it makes a write call, the kernel will not return control to the program until the data has been written into the buffer. This gives the reading program CPU time in which to empty the buffer.

Answer 5

Maybe you only need the files, then use tar. You can fill with zeros the blocks that don't contain anything you want, somebody has already asked about it. Clear unused space with zeros (ext3,ext4)

Then, there's pigz which is usually faster than gzip.